Fewer than most quotations assume. Count the decisions you need footage to settle, and each one becomes a camera position. Everything else is a camera watching a wall.
A response time in writing, a named engineer, preventive visits and an asset register you keep. If the contract does not state the exclusions, that is the clause you will argue about in month seven.
Cat6 for the desks, Cat6A for the runs feeding wireless access points and camera aggregation. Cable outlives three generations of the equipment plugged into it, so re-pulling later costs more than the cable ever did.
Nothing is ever removed from a rule base. The permit written for a vendor's one-week job is still open three years later, and that is the door an attacker finds before you do.
Backup gets your data back. Disaster recovery gets your business working while that happens. The two are quoted as one line item and they are not the same purchase.
A second password is not a second network. Guest devices belong on their own VLAN with client isolation and no route inward, and the ISP router cannot do any of that.